Hacker News Reader

Comment by MisterWebz | Hacker News Reader

Here's something interesting I found on wikipedia. According to the "General Data Protection Regulation", which is a data protection law and is supposed to take effect in 2016 in the EU:

the Regulation also applies to organizations based outside the European Union if they process personal data of EU residents.

Further in the section "Discussion and challenges":

The new regulation conflicts with other non-European laws and regulations and practices (e.g. surveillance by governments). Companies in such countries should not be acceptable for processing EU personal data anymore.

What are your thoughts on this?

Source: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

View on HN

Data on intra-european transactions and matters is often deliberately shared with the US for intelligence purposes OR is processed by companies in the US, which automatically means that it is used by the US for intelligence.

So, if I use Gmail as a non US citizen, I have to assume that the US government will read/analyze my emails. That's a well recognized fact that I've also been told by people working with classified (German) government data on multiple occasions.

Examples: http://epic.org/privacy/intl/passenger_data.html http://en.wikipedia.org/wiki/Society_for_Worldwide_Interbank...

But that does not address the fact that according to the GDPR in its current state, a company such as Google should not have the authority to process EU citizen's data unless it's fully compliant with GDPR.

How they're going to enforce that, I have no idea. Now if I've understood this correctly, this means that if a foreign company is fully complaint with this new law, we would have much greater access to data that is being collected, and we also have the power to request the removal of said data. The US government might still collect all those incoming data before it has the chance to be removed, but having a law such as GDPR being enforced would be a huge step forward.

There is, at least in theory, the Safe Harbor arrangement (https://en.wikipedia.org/wiki/International_Safe_Harbor_Priv...) which allows US companies to hold themselves up to the EU directive standards, and the EU to take their word for it.

However, it is a self-certification program and it isn't really a US law, just a regulation enforced by the FTC. So while it should protect your data from third parties, e.g., being sold to advertisers, etc., it most likely does not protect your data from the US government.

the Safe Harbor asks compliance with the Data Protection Directive which is supposed to become obsolete in the following few years. Not to mention that it's apparently opt-in, which is basically useless.

Reply on news.ycombinator.com